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1.1 This policy applies to all employees of the Information Commissioner's 
Office. Where the Policy refers to ‘the ICO’, it refers to the 
organisation as a whole, the Information Commissioner and individual 
staff. 


1.2 The ICO is bound under the DPA 2018 and GDPR to engage in many 
forms of collaboration. These are not within the scope of this policy. 
This policy should only be used in application to collaboration which 
the ICO is entering into voluntarily, rather than as a requirement of its 
regulatory role. 


2. Introduction 


2.1 This policy provides guidance on how to deal with requests for 
collaboration with a third party. Third parties are all organisations and 
individuals outside the ICO. Such involvement by the ICO may give 
the impression that it endorses the third party. This may, in turn, give 
the impression that the organisation is a recognised authority on 
information rights, openness of public bodies or data privacy. The ICO 
needs to be very careful in managing this perception. 


2.2 The key role of the ICO is to "uphold information rights in the public 
interest, promoting openness by public bodies and data privacy for 


individuals." 

2.3 You should bear this role in mind when considering issues in relation 
to this policy. 

ce Support and Collaboration 

3.1 There are many forms of collaboration which the ICO may engage in 


with third parties. The guiding principle is that any work which the ICO 
engages in which may potentially give the impression to the public 
that it in any way endorses a third party should be considered in the 
light of this policy. 


4. Issues to consider when deciding on collaboration 


4.1 The issues to consider when deciding on the ICO’s engagement in 
collaboration with third parties will vary for each request. 


4.2 A specific issue which should be considered in every case is whether 
you are aware that the ICO is engaged in or considering enforcement 
action against the third party. You are not expected to be aware of all 
such instances, but where you are aware you should act accordingly: 
in these circumstances, it will not usually be appropriate for the ICO to 
collaborate with that third party. However, it may be appropriate if the 
support is specifically designed to address the cause of the ICO’s 
investigation. 
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4.3 


Consideration should also be given as to whether the third party has 
paid the Data Protection Fee, if they are required to do so. This should 
be checked before agreeing collaborate with a third party. 


4.4 Where we are taking part in collaboration which involves a number of 
third parties, the considerations set out below should be applied to all 
organisations involved. 

4.4 Examples of further potential issues are set out below: 


Issue 


Consideration 


Is the third party a commercial 
(private sector) or non- 
commercial (public sector or 
charity) organisation? Where it is 
an individual, this should 
generally be considered a 
commercial organisation. 


It will usually be easier to 
collaborate with non-commercial 
third parties, as typically the 
goals of these third parties is 
more likely to be aligned with that 
of the ICO. 


Is the type of collaboration 
proposed intrinsic to the 
document/event (e.g. inclusion of 
the ICO logo on a document or 
making a key-note speech) or 
incidental to it (e.g. a request for 
a comment on a document, or 
attendance at an event with no 
set role)? 


Where the ICO’s support is 
intrinsic to the document/event, it 
is reasonable for the ICO to 
request more control over the 
final form of the document/event. 
In many cases (such as the use of 
the ICO logo on an information 
booklet) it would be reasonable 
for the ICO to review the full final 
text of the report before the logo 
is provided. 


There is a significant reputational 
risk if the ICO lends its voice to 
inaccurate information. 


What is the reputation of the third 
party, both generally and 
particularly in relation to 
information rights? 


It will be easier for the ICO to 
collaborate with a third party 
which has a respected reputation 
either in information rights or 
their respective field. 


What other third parties are being 
asked for collaboration? 


Related to the above, the 
perception of other third parties 
who are involved may create 
reputational risks. For example, 
including the ICO’s logo in an 
information booklet alongside that 
of a third party against whom the 
ICO is currently considering or 
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engaged in enforcement action. 


What is the audience? The ICO will be more able to 
collaborate with third parties if the 
audience of the work is focused 
around promoting information 


rights. 
Will the publicity from a proposed | Collaboration will be more 
collaboration promote the ICO’s beneficial when it ensures that an 
priorities? audience is talking about an issue 


which the ICO wishes to promote. 


Is the involvement requested of The ICO should be careful not to 


the ICO relevant to the ICO’s overstep its role. There may be 
role? Does it give the impression other organisations who are more 
that the ICO has a role that it appropriately placed to provide 
does, in fact, not? the collaboration requested. If you 


have any concerns about whether 
any collaboration may be beyond 
the natural borders of the ICO’s 
work, you should consult with a 
Head of Department. 


4.5 


This list of potential issues and considerations is not intended to be 
exhaustive. You will need to use your own judgement to identify the 
potential issues you will need to consider and the implications of those 
issues. You may wish to consult with a range of colleagues to identify 
these issues, particularly Corporate Communications and Private 
Office. 


4.6 


You should take a risk-based approach to considering whether to 
engage with a third party. In some instances, it may be worth taking 
risks, in others it may not. You should take direction from the 
organisation’s Risk Appetite statement, as set out within the Risk 
Register. 


5. Responsibilities 


5.1 All staff are responsible for ensuring that due consideration is given to 
the issues set out within this policy. 
5.2 Corporate Governance is responsible for ensuring that this policy 


remains appropriate and up to date. 


Chris Braithwaite 
Corporate Governance 
September 2018 
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